State of New York
Department of State
Committee on Open Government

The staff of the Committee on Open Government is authorized to issue
advisory opinions. The
ensuing staff advisory opinion is based solely upon the information
presented in your
correspondence.

Dear

Your inquiry addressed to the State Department of Health has been
forwarded to the
Committee on Open Government. The Committee, a unit of the Department
of State, is authorized
to offer advice and opinions pertaining to the state's Freedom of Information
and Personal Privacy
Protection Laws.

You wrote that a state agency that employs one of you "requires
that each employee's Social
Security Number be written on each four week time card although the
SS numbers of each employee
are already on file with the Agency." You added that the "time
cards are routinely viewed by several
people as they are processed and the Agency has a record of disclosing
medical records and other
documentation containing employees' SS numbers thru [sic] group e-mailings." You
have asked
whether "anything can be done to stop these practices."

In this regard, the authority of this office is advisory, and neither
myself nor the Committee
is empowered to compel an agency to stop or initiate its practices.
However, it is our hope that
advisory opinions, such as this, are educational and persuasive, and
that they serve to resolve
problems and promote understanding of and compliance with law. If you
see fit to do so, you may
share this opinion with your agency, and with that, I offer the following
comments.

From my perspective, two statutes are pertinent to the matter.

First, although the federal Privacy Act (5 USC 552a) generally applies
to federal agencies,
one aspect of the Act pertains to entities of state and local government,
and it relates to the ability
to require that individuals provide their social security numbers.
Section 7 of the Privacy Act states
that:

"(a)(1) [I]t shall be unlawful for any Federal, State or local
government agency to deny to any individual any right, benefit, or
privilege provided by law because of such individual's refusal to
disclose his social security number.

(2) the provision of paragraph (a) of this subsection
shall not apply with respect to --

(A) any disclosure which is required by Federal
Statute, or

(B) the disclosure of a social security number to any
Federal, State, or local agency maintaining a system of
records in existence and operating before January 1,
1975, if such disclosure was required under statute or
regulation adopted prior to such date to verify the
identity of an individual

(b) Any Federal, State, or local government agency which requests
an individual to disclose his social security account number shall
inform that individual whether that disclosure is mandatory or
voluntary, by what statutory or other authority such number is
solicited, and what uses will be made of it."

The quoted provision places limitations upon the collection and use
of social security numbers by
government, and unless "grandfathered in" under the Privacy
Act, agencies cannot require the
submission of social security numbers, except in conjunction with social
security or other statutorily
authorized purposes. As you have described the situation, the agency
that employs you cannot
require you or other employees to include your social security numbers
on your time cards.

Second, the state's Personal Privacy Protection Law deals in part
with the authority of state
agencies to collect personal information. Section 94(1) of that statute
states that, unless a person,
a "data subject", provides an agency with "unsolicited
personal information", the agency shall
"maintain in its records only such personal information which is
relevant and necessary to
accomplish a purpose of the agency required to be accomplished by statute
or executive order, or to
implement a program specifically authorized by law..." While you
may be required to supply certain
information on a time card, I do not believe that a social security
number is "relevant and necessary"
to the agency to carry out its functions relating to attendance. If
that is so, the agency's practice
would be inconsistent with the Personal Privacy Protection Law.

I hope that I have been of assistance. Should any questions arise
concerning the foregoing,
please feel free to contact me.